Create OUTSIDE Network with rbac policy instead of router:external flag

Adding the rbac policy automagically updates the router type, setting
the router:external flag to True, so we also change our search criterion
to match existing Networks regardless of the router:external value.

Author: stevekeay

python/understack-workflows/understack_workflows/main/sync_keystone.py

@@ -73,38 +73,45 @@ def is_valid_domain(
 
 
 def _create_outside_network(conn: Connection, project_id: uuid.UUID):
-    payload = _outside_network_payload(project_id)
-    network = conn.network.find_network(**payload)  # type: ignore
+    network = _find_outside_network(conn, project_id)
     if network:
         logger.info(
             "%s Network %s already exists for this tenant",
             OUTSIDE_NETWORK_NAME,
             network.id,
         )
     else:
-        payload.update(name=payload.pop("name_or_id"))
+        payload = {
+            "project_id": project_id,
+            "name": OUTSIDE_NETWORK_NAME,
+            "router:external": False,
+        }
         network = conn.network.create_network(**payload)  # type: ignore
         logger.info(
             "Created %s Network %s for tenant", OUTSIDE_NETWORK_NAME, network.id
         )
+        conn.network.create_rbac_policy(  # type: ignore
+            object_type="network",
+            object_id=network.id,
+            action="access_as_external",
+            target_project_id=project_id,
+        )
 
 
 def _delete_outside_network(conn: Connection, project_id: uuid.UUID):
-    payload = _outside_network_payload(project_id)
-    network = conn.network.find_network(**payload)  # type: ignore
+    network = _find_outside_network(conn, project_id)
     if network:
         conn.delete_network(network.id)
         logger.info(
             "Deleted %s Network %s for this tenant", OUTSIDE_NETWORK_NAME, network.id
         )
 
 
-def _outside_network_payload(project_id: uuid.UUID) -> dict:
-    return {
-        "project_id": project_id,
-        "name_or_id": OUTSIDE_NETWORK_NAME,
-        "router:external": True,
-    }
+def _find_outside_network(conn, project_id):
+    return conn.network.find_network(  # type: ignore
+        project_id=project_id,
+        name_or_id=OUTSIDE_NETWORK_NAME,
+    )
 
 
 def handle_project_create(